Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

techsolvency.com

Post reply on HN
Print view View original

11–20 of 209 posts

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#11

Post by winternett »

mateuszf wrote: post #5
benburleson wrote: post #4

Earlier quoted context omitted.

"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)

Yeah - for example to determine if log4j is used in a maven project one would have to run "mvn dependency:tree | grep log4j". Which I did today for our 60 microservices. And also for projects deployed as war files - container server libraries also have to be checked.

Also found this link today -

https://support.lucidworks.com/hc/en-us/articles/44156492440...

I'm glad I couldn't get SOLR to work on indexing PDFs for a client project last year and I chose an alternate solution after reading it today...

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#17

Post by winternett »

blibble wrote: post #7
mateuszf wrote: post #5

Earlier quoted context omitted.

Yeah - for example to determine if log4j is used in a maven project one would have to run "mvn dependency:tree | grep log4j". Which I did today for our 60 microservices. And also for projects deployed as war files - container server libraries also have to be checked.

you better hope one of your dependencies hasn't vendored it!

The key for me is to have a solid backup/disaster recovery plan in place and to first assess what rollback would entail and to verify that backup data is not corrupted. Rollback is more of a final (nuclear) option, but I always need to verify that it is an option...

Data loss from rollback is far better than total corruption (if it ever gets to that point, God forbid).

It also depends greatly on the availability needs for a system of course, but everyone has to be reasonable over things they can't pre-conceive or control in these types of situations because there's no way anything can operate flawlessly and without failure.

1. The Titanic

2. The Hindenburg

3. The AWS-East Service Outage This Month

:\

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#18

Post by eganist »

ronnier wrote: post #12

Are there any notable systems exploited by this besides minecraft?

you could probably fire a bullet in any direction and hit a company with hundreds of apps or appliances affected.

I recognize this probably isn't helpful on its face, but the best way to think of it is: if it's a Java app (or heck even possibly just an app running on the JVM) that uses the most recent major version (2.x before 2.15.0, the patch) of the most common logging logic, it's affected.

And that list in the enterprise space gets exceptionally long. Maybe not so much on client machines, but servers/etc absolutely.

Even companies not known for using Java for their own apps are probably relying on appliances or systems which run their own vulnerable Java apps.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#19

Post by ThinkBeat »

Ideally, log4j should not have the ability to make "outgoing calls" right?

It has been years since I used it but I can't remember a valid reason why it should be allowed to do so.

Since it is running inside the stack it may not be easy to enforce it. If the "client" log4j does it before even logging that is a bother.

It seems like having a "central" "syslog" logging server.

Traffic goes from the stack -> logging server. Logging server not allowed to call anyone external.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#20

Post by tyingq »

ronnier wrote: post #12

Are there any notable systems exploited by this besides minecraft?

Many, many of them. See the gist posted in another comment: https://news.ycombinator.com/item?id=29543439

Though even that long list is missing many. I have lots of emails in my inbox from various software vendors that are NOT listed in that Gist.

It's probably easier to compile a list of software you use that uses java, then the short of those projects that DON'T use log4j.

Post reply on HN